United States Patent and Trademark Office 



UNITED STATES DEPARTMENT OF COMMERCE 
United States Patent and Trademark Office 

Address: COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 



NOTICE OF ALLOWANCE AND FEE(S) DUE 



21912 7590 12/23/2008 

VAN PELT, YI & JAMES LLP 
10050 N. FOOTHILL BLVD #200 
CUPERTINO, CA 95014 



MERED, HABTE 



PAPER NUMBER 



2416 

DATE MAILED: 12/23/2008 



| APPLICATION NO. j FILING DATE J FIRST NAMED INVENTOR | ATTORNEY DOCKET NO. | CONFIRMATION NO. 

10/076,952 02/15/2002 Michael P. Lyle RECOP020 3408 

TITLE OF INVENTION: ROUTING NETWORK PACKETS FOR MULTI-PROCESSOR NETWORK FLOW ANALYSIS 



| APPLN. TYPE | SMALL ENTITY | ISSUE FEE DUE | PUBLICATION FEE DUE | PREV. PAID ISSUE FEE | TOTAL FEEfS; DUE | DATE DUE j 

nonprovisional NO $1510 SO $0 $1510 03/23/2009 

THE APPLICATION IDENTIFIED ABOVE HAS BEEN EXAMINED AND IS ALLOWED FOR ISSUANCE AS A PATENT. 
PROSECUTION ON THE MERITS JS CLOSED . THIS NOTICE OF ALLOWANCE IS NOT A GRANT OF PATENT RIGHTS. 
THIS APPLICATION IS SUBJECT TO WITHDRAWAL FROM ISSUE AT THE INITIATIVE OF THE OFFICE OR UPON 
PETITION BY THE APPLICANT. SEE 37 CFR 1.313 AND MPEP 1308. 

THE ISSUE FEE AND PUBLICATION FEE (IF REQUIRED) MUST BE PAID WITHIN THREE MONTHS FROM THE 
MAILING DATE OF THIS NOTICE OR THIS APPLICATION SHALL BE REGARDED AS ABANDONED. THIS 
STATUTORY PERIOD CANNOT BE EXTENDED . SEE 35 U.S.C. 151. THE ISSUE FEE DUE INDICATED ABOVE DOES 
NOT REFLECT A CREDIT FOR ANY PREVIOUSLY PAID ISSUE FEE IN THIS APPLICATION. IF AN ISSUE FEE HAS 
PREVIOUSLY BEEN PAID IN THIS APPLICATION (AS SHOWN ABOVE), THE RETURN OF PART B OF THIS FORM 
WILL BE CONSIDERED A REQUEST TO REAPPLY THE PREVIOUSLY PAID ISSUE FEE TOWARD THE ISSUE FEE NOW 
DUE. 



HOW TO REPLY TO THIS NOTICE: 



I. Review the SMALL ENTITY status shown above. 

If the SMALL ENTITY is shown as YES, verify your current 
SMALL ENTITY status: 

A. If the status is the same, pay the TOTAL FEE(S) DUE shown 
above. 

B. If the status above is to be removed, check box 5b on Part B - 
Fee(s) Transmittal and pay the PUBLICATION FEE (if required) 
and twice the amount of the ISSUE FEE shown above, or 



If the SMALL ENTITY is shown as NO: 



A. Pay TOTAL FEE(S) DUE shown above, or 



B. If applicant claimed SMALL ENTITY status before, or is now 
claiming SMALL ENTITY status, check box 5a on Part B - Fee(s) 
Transmittal and pay the PUBLICATION FEE (if required) and 1/2 
the ISSUE FEE shown above. 



II. PART B - FEE(S) TRANSMITTAL, or its equivalent, must be completed and returned to the United States Patent and Trademark Office 
(USPTO) with your ISSUE FEE and PUBLICATION FEE (if required). If you are charging the fee(s) to your deposit account, section "4b" 
of Part B - Fee(s) Transmittal should be completed and an extra copy of the form should be submitted. If an equivalent of Part B is filed, a 
request to reapply a previously paid issue fee must be clearly made, and delays in processing may occur due to the difficulty in recognizing 
the paper as an equivalent of Part B. 

III. All communications regarding this application must give the application number. Please direct all communications prior to issuance to 
Mail Stop ISSUE FEE unless advised to the contrary. 

IMPORTANT REMINDER: Utility patents issuing on applications filed on or after Dec. 12, 1980 may require payment of 
maintenance fees. It is patentee's responsibility to ensure timely payment of maintenance fees when due. 



PTOL-85 (Rev. 08/07) Approved for use through 08/3 1/2010. 



Page 1 of 3 



PART B - FEE(S) TRANSMITTAL 

Complete and send this form, together with applicable fee(s), to: Mail Mail Stop ISSUE FEE 

Commissioner for Patents 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
or Fax (571)-273-2885 

INSTRUCTIONS: This form should be used for transmitting the ISSUE FEE and PUBLICATION FEE (if required). Blocks 1 through 5 should be completed where 
appropriate. All further correspondence including the Patent, advance orders and notification of maintenance fees will be mailed to the current correspondence address as 
indicated unless corrected below or directed otherw ise in Block 1. b\ (a) specifying a new correspondence address; and/or (b) indicating a separate "FEE ADDRESS" for 
maintenance fee notifications. 



CURRENT CORRESPONDENCE ADDRESS (Note: Use Block 1 foi am change of address 
21912 7590 12/23/2008 

VAN PELT, YI & JAMES LLP 
10050 N. FOOTHILL BLVD #200 
CUPERTINO, CA 95014 



Note: A certificate of mailing can only be used for domestic mailings of the 
Fee(s) Transmittal. This certificate cannot be used for any other accompanying 
papers. Each additional paper, such as an assignment or formal drawing, must 
have its own certificate of mailing or transmission. 

Certificate of Mailing or Transmission 

I hereby certify that this Fee(s) Transmittal is being deposited with the United 
States Postal Service with sufficient postage for first class mail in an envelope 
addressed to the Mail Stop ISSUE FEE address above, or being facsimile 
transmitted to the USPTO (571 ) 273-2885, on the date indicated below. 



(Depositor's i 



APPLICATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. CONFIRMATION NO. 



10/076,952 02/15/2002 Michael P. Lyle RECOP020 

TITLE OF INVENTION: ROUTING NETWORK PACKETS FOR MULTI-PROCESSOR NETWORK FLOW ANALYSIS 



APPLN. TYPE 



SMALL ENTITY 



ISSUE FEE DUE PUBLICATION FEE DUE PREV. PAID ISSUE FEE TOTAL FEE(S) DUE 



nonprovisional 



CLASS-SUBCLASS 



Ml Rl I) HABTE 



2416 



e addi e 



ndicalit 



e Address" (37 



1. Change of corres 
CFR 1.363). 

Q Change of correspondence address (or Change of Correspondence 
Address form PTO/SB/122) attached. 

U "Fee Address" indication (or "Fee Address" Indication form 
PTO/SB/47; Rev 03-02 or more recent) attached. Use of a Customer 
Number is required. 



■rpnnti 



the patent front page, list 



(1) the names of up to 3 registered patent attorneys 1 - 
or agents OR, alternatively, 

(2) the name of a single firm (having as a member a 2 - 
registered attorney or agent) and the names of up to 

2 registered patent attorneys or agents. If no name is 3 
listed, no name will be printed. 



3. ASSIGNEE NAME AND RESIDENCE DATA TO BE PRINTED ON THE PATENT (print or type) 

PLEASE NOTE: Unless an assignee is identified below, no assignee data will appear on the patent. If an ass 
recordation as set forth in 37 CFR 3.11. Completion of this form is NOT a substitute for filing an assignment. 

(A) NAME OF ASSIGNEE (B) RESIDENCE: (CITY and STATE OR COUNTRY) 



identified below, the document has been filed for 



Please check the appropriate assignee category or categories (will not be printed on the patent) : O Individual Q Corporation or other private group entity Q Government 

4a. The following fee(s) are submitted: 4b. Payment of Fee(s): (Please first reapply any previously paid issue fee shown above) 

□ Issue Fee □ A check is enclosed. 

L_l Publication Fee (No small entity discount permitted) Q Payment by credit card. Form PTO-2038 is attached. 

LI Advance Order - # of Copies Q The Director is hereby authorized to charge the required fee(s), any deficiency, or credit any 

overpayment, to Deposit Account Number (enclose an extra copy of this form). 

5. Change in Entity Status (from status indicated above) 

□ a. Applicant claims SMALL ENTITY status. See 37 CFR 1.27. □ b. Applicant is no longer claiming SMALL ENTITY status. See 37 CFR 1.27(g)(2). 

NOTE: The Issue Fee and Publication Fee (if required) will not be accepted from anyone other than the applicant; a registered attorney or agent; or the assignee or other party in 
interest as shown by the records of the United States Patent and Trademark Office. 

Authorized Signature Date 



Typed or printed name Registration No. _ 



This collection of information is required by 37 CFR 1.31 1. The information is required to obtain or retain a benefit by the public which is to file (and by the USPTO to process) 
an application. Confidentiality is governed by 35 U.S.C. 122 and 37 CFR 1.14. This collection is estimated to take 12 minutes to complete, including gathering, preparing, and 
submitting the completed application form to the USPTO. Time will vary depending upon the individual case. Any comments on the amount of time you require to complete 
this form and/or suggestions for reducing this burden, should be sent to the C hid Information Officer. U.S. Patent and Trademark Office, U.S. Department of Commerce, P.O. 
Box 1450, Alexandria. Virginia 223 1 3-1450. DO NOT SEND FEES OR COMPLETED FORMS TO THIS ADDRESS. SEND TO: Commissioner for Patents, P.O. Box 1450, 
Alexandria, Virginia 22313-1450. 

Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. 



PTOL-85 (Rev. 08/07) Approved for use through 08/3 1/2010. 



OMB 0651-0033 U.S. Patent and Trademark Office; U.S. DEPARTMENT OF COMMERCE 



United States Patent and Trademark Office 



UNITED STATES DEPARTMENT OF COMMERCE 
United States Patent and Trademark Office 

Address: COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 



APPLICATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. CONFIRMATION NO. 



10/076,952 



02/15/2002 



Michael P. Lyle 



21912 7590 12/23/2008 

VAN PELT, YI & JAMES LLP 
10050 N. FOOTHILL BLVD #200 
CUPERTINO, CA 95014 



MERED, HABTE 



PAPER NUMBER 



2416 

DATE MAILED: 12/23/2008 



Determination of Patent Term Adjustment under 35 U.S.C. 154 (b) 

(application filed on or after May 29, 2000) 

The Patent Term Adjustment to date is 852 day(s). If the issue fee is paid on the date that is three months after the 
mailing date of this notice and the patent issues on the Tuesday before the date that is 28 weeks (six and a half 
months) after the mailing date of this notice, the Patent Term Adjustment will be 852 day(s). 

If a Continued Prosecution Application (CPA) was filed in the above-identified application, the filing date that 
determines Patent Term Adjustment is the filing date of the most recent CPA. 

Applicant will be able to obtain more detailed information by accessing the Patent Application Information Retrieval 
(PAIR) WEB site (http://pair.uspto.gov). 

Any questions regarding the Patent Term Extension or Adjustment determination should be directed to the Office of 
Patent Legal Administration at (571)-272-7702. Questions relating to issue and publication fee payments should be 
directed to the Customer Service Center of the Office of Patent Publication at l-(888)-786-0101 or 
(571)-272-4200. 



PTOL-85 (Rev. 08/07) Approved for use through 08/3 1/2010. 



Page 3 of 3 





Application No. 


Applicant(s) 


Notice of Allowability 


10/076,952 


LYLE, MICHAEL P. 


Examiner 


Art Unit 






HABTE MERED 


2416 





~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . This communication is responsive to 10/14/2008 . 

2. ^ The allowed claim(s) is/are 1-6 and 9-20 . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d)or(f). 

a) □ All b)DSome* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1 ) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 
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of Biological Material 
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DETAILED ACTION 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
10/14/08 has been entered. 



EXAMINER'S AMENDMENT 



2. An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with William J. James (40, 661) on 12/17/08. 

The application has been amended as follows: 

3. Claims 21 and 22 are cancelled. 



Application/Control Number: 10/076,952 Page 3 

Art Unit: 2416 

4. In Claim 1 , in line 1 0 after the phrase "determined at least in part by the number 
of processors included in said plurality of processors;" the following phrase has been 
inserted: 

- - wherein each of at least a subset of processors comprising said plurality of 
processors is configured to perform concurrently two or more network flow 
analysis related tasks; - - 

5. In Claim 14, the first three lines of claim 14 have been replaced by the following 
phrase: 

- - A computer readable storage medium embodied with a computer program 
product for routing data packets for a network flow analysis by a multi-processor 
system, the computer program product executed by the multi-processor system, 
comprises computer instructions for: - - 

6. In Claim 14, in line 1 1 after the phrase "is determined at least in part by the 
number of processors included in said plurality of processors;" the following phrase has 
been inserted: 

- - wherein each of at least a subset of processors comprising said plurality of 
processors is configured to perform concurrently two or more network flow 
analysis related tasks; - - 

7. In Claim 15, in line 3 after the phrase "a plurality of processors configured to 
perform network flow analysis;" the following phrase has been inserted: 
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- - wherein each of at least a subset of processors comprising said plurality of 
processors is configured to perform concurrently two or more network flow 
analysis related tasks; - - 



Allowable Subject Matter 

8. Claims 1-6 and 9-20 are allowed. 

9. The following is an examiner's statement of reasons for allowance: 

Claim 1 and all of its dependent claims 2-6 and 9-13 are allowable over the 
prior art of record since the cited references taken individually or in combination fail to 
particularly teach or suggest a method for routing data packets for network flow analysis 
by a multi-processor system having a plurality of processors, comprising: 

receiving a data packet, the data packet comprising data sufficient to identify a 
network connection with which the data packet is associated; 

calculating a hash value based on said data sufficient to identify the network 
connection with which the data packet is associated: and 

assigning the data packet based on said hash value to one of said plurality of 
processors for analysis bv using a number of bits of the hash value, wherein the number 
of bits used is not necessarily the total number of bits of the hash value and the number 
of bits used is determined at least in part bv the number of processors included in said 
plurality of processors; 
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wherein each of at least a subset of processors comprising said plurality of 
processors is configured to perform concurrently two or more network flow 
analysis related tasks: 

wherein the data packet is assigned to said one of said plurality of processors by 
storing: in a work queue associated with said one of said plurality of processors: a 
pointer to a storage location in which data comprising the data packet is stored: and the 
processor is configured to read the pointer, use the pointer to read the data comprising 
the data packet directly from the storage location in which said data comprising the data 
packet is stored, use the data comprising the data packet to perform a network flow 
analysis with respect to a network flow with which the data packet is associated, and 
store in a return queue associated with the processor a data indicating that the 
processor is finished processing the data comprising the data packet: and wherein the 
data indicating that the processor is finished processing the data comprising the data 
packet is used to determine that the storage location is available to be used to store a 
subsequently received data comprising a subsequently received data packet; and 
further comprising reading the pointer from the return queue and using the pointer read 
from the return queue to add the storage location to a free list of storage locations 
available to be assigned to a network communication interface configured to receive the 
subsequently received data packet and to store said subsequently received data 
comprising the subsequently received data packet . 

It is noted the closest prior art Shanklin'147 discloses a parallel intrusion 
detection sensors for network flow analysis but does not include use of hash value 



Application/Control Number: 10/076,952 Page 6 

Art Unit: 2416 

calculation to identify a connection as well as use of work and return queues to 
manipulate the received packets. 

Claim 14 is allowed over the prior art of record since the cited references taken 
individually or in combination fail to particularly teach or suggest a computer readable 
storage medium embodied with a computer program product for routing data packets for 
a network flow analysis by a multi-processor system, the computer program product 
executed by the multi-processor system, comprises computer instructions for: 

receiving a data packet, the data packet comprising data sufficient to identify a 
network connection with which the data packet is associated; 

calculating a hash value based on said data sufficient to identify the network 
connection with which the data packet is associated: and 

assigning the data packet based on said hash value to one of said plurality of 
processors for analysis bv using a number of bits of the hash value, wherein the number 
of bits used is not necessarily the total number of bits of the hash value and the number 
of bits used is determined at least in part bv the number of processors included in said 
plurality of processors; 

wherein each of at least a subset of processors comprising said plurality of 
processors is configured to perform concurrently two or more network flow 
analysis related tasks: 

wherein the data packet is assigned to said one of said plurality of processors bv 
storing: in a work queue associated with said one of said plurality of processors: a 
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pointer to a storage location in which data comprising the data packet is stored: and the 
processor is configured to read the pointer, use the pointer to read the data comprising 
the data packet directly from the storage location in which said data comprising the data 
packet is stored, use the data comprising the data packet to perform a network flow 
analysis with respect to a network flow with which the data packet is associated, and 
store in a return queue associated with the processor a data indicating that the 
processor is finished processing the data comprising the data packet: and wherein the 
data indicating that the processor is finished processing the data comprising the data 
packet is used to determine that the storage location is available to be used to store a 
subsequently received data comprising a subsequently received data packet: and 
further comprising computer instructions for reading the pointer from the return queue 
and using the pointer read from the return queue to add the storage location to a free 
list of storage locations available to be assigned to a network communication interface 
configured to receive the subsequently received data packet and to store said 
subsequently received data comprising the subsequently received data packet. 

It is noted the closest prior art Shanklin'147 discloses a parallel intrusion 
detection sensors for network flow analysis but does not include use of hash value 
calculation to identify a connection as well as use of work and return queues to 
manipulate the received packets. 

Claims 15 and all of its dependent claims 16-20 are allowed over the prior art 
of record since the cited references taken individually or in combination fail to 
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particularly teach or suggest a system for routing data packets for network flow analysis, 
comprising: 

a plurality of processors configured to perform network flow analysis; 

wherein each of at least a subset of processors comprising said plurality of 
processors is configured to perform concurrently two or more network flow 
analysis related tasks: 

a network interface card configured to receive data packets via a network 
connection, each data packet comprising data sufficient to identify a network connection 
with which the data packet is associated: and 

a driver configured to: 

calculate a hash value based on said data sufficient to identify the network 

connection with which the data packet is associated: and 

assign the data packet based on said hash value to one of said plurality of 

processors for analysis bv using a number of bits of the hash value, wherein the 

number of bits used is not necessarily the total number of bits of the hash value 

and the number of bits used is determined at least in part bv the number of 

processors included in said plurality of processors; 
wherein the data packet is assigned to said one of said plurality of processors bv 
storing: in a work queue associated with said one of said plurality of processors: a 
pointer to a storage location in which data comprising the data packet is stored: and the 
processor is configured to read the pointer, use the pointer to read the data comprising 
the data packet directly from the storage location in which said data comprising the data 
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packet is stored, use the data comprising the data packet to perform a network flow 
analysis with respect to a network flow with which the data packet is associated, and 
store in a return queue associated with the processor a data indicating that the 
processor is finished processing the data comprising the data packet: and wherein the 
data indicating that the processor is finished processing the data comprising the data 
packet is used to determine that the storage location is available to be used to 
store a subsequently received data comprising a subsequently received data packet: 
and wherein the driver is further configured to read the pointer from the return queue 
and use the pointer read from the return queue to add the storage location to a free list 
of storage locations available to be assigned to the network interface card . 

It is noted the closest prior art Shanklin'147 discloses a parallel intrusion 
detection sensors for network flow analysis but does not include use of hash value 
calculation to identify a connection as well as use of work and return queues to 
manipulate the received packets. 

Claims 1-6 and 9-20 are also allowable over the prior art of record since the cited 
references taken individually or in combination fail to teach the invention claimed 
in these claims as argued by Applicant in the Remarks filed on 10/14/08. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
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accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to HABTE MERED whose telephone number is (571)272- 
6046. The examiner can normally be reached on Monday to Friday 9:30AM to 5:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Aung S. Moe can be reached on 571 272 7314. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Aung S. Moe/ /Habte Mered/ 

Supervisory Patent Examiner, Art Unit 2416 Examiner, Art Unit 2416 

12-18-08 



